CVE-2017-1000037

CVE-2017-1000037 (RVM) : The connected sources document a code-execution/command-injection vulnerability in the Ruby Version Manager (RVM) where environment variables are automatically loaded from files in the current working directory ($PWD). This behavior allows arbitrary code execution when im...

Hashview - A Web Front-End For Password Cracking And Analytics

Hashview is a tool for security professionals to help organize and automate the repetitious tasks related to password cracking. Hashview is a web application that manages hashcat https://hashcat.net commands. Hashview strives to bring constiency in your hashcat tasks while delivering analytics wi...

Password Cracking Web Front-End: Hashview

Password Cracking Web Front-End Hashview is a tool for security professionals to help organize and automate the repetitious tasks related to password cracking. Hashview is a web application that manages hashcat https://hashcat.net commands. Hashview strives to bring constiency in your hashcat tas...

RVM command injection when automatically loading environment variables from files in $PWD

RVM, by default, hooks cd and automatically detects the presence of certain files in the directory being changed to. These files and their mechanics are detailed at . The code that parses these files is available at look for the rvmloadprojectconfig function. The code, as of a vulnerable commit, ...

RVM automatically installs gems as specified by files in $PWD

RVM, by default, hooks cd and automatically parses a file named .versions.conf in the directory being changed to. This file can provide the names of arbitrary gems, via ruby-gem-install entries, which will be automatically passed to gem install upon cd into the directory. The code responsible, as...

RVM automatically loads environment variables from files in $PWD

RVM, by default, hooks cd and automatically detects the presence of certain files in the directory being changed to. These files and their mechanics are detailed at . The code that parses these files is available at look for the rvmloadprojectconfig function. The code, as of a vulnerable commit, ...

RVM automatically executes hooks located in $PWD

RVM, by default, hooks cd and automatically executes various auxiliary hooks when a user changes into a directory. The mechanics of these additional aftercd hooks are detailed at . What this page fails to mention is that hooks, as of a vulnerable version, are not only loaded from /.rvm/hooks but...

RVM automatically does "bundle install" on a Gemfile specified by .versions.conf in $PWD

RVM, by default, hooks cd and automatically parses a file named .versions.conf in the directory being changed to. The intention seems to be that, if the user's $rvmautoinstallbundlerflag setting is enabled, then .versions.conf can specify a Gemfile that will automatically be fed to bundle install...

Continuous Security Integration Framework: CSI

Continuous Security Integration Framework It’s easy to agree that while corporate automation is a collection of proprietary source code, the core modules used to produce automated solutions should be open for all eyes to continuously promote trust and innovation…broad collaboration is key to any...

Ruggedization Framework For Security Testing: Gauntlt

Gauntlt is a ruggedization framework that is enables security testing that is usable by devs, ops and security. Gauntlt provides hooks to a variety of security tools and puts them within reach of security, dev and ops teams to collaborate to build rugged software. It is built to facilitate testin...

RVM moFahr - Exported ContentProvider, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application RVM moFahr published at the 'play' market has multiple vulnerabilities...

CVE-2015-0526

CVE-2015-0526 pertains to EMC RSA Validation Manager (RVM) 3.2 prior to build 201. The vulnerability arises from cross-site scripting (XSS) in the UI through the parameters displayMode and wrapPreDisplayMode , allowing remote attackers to inject arbitrary script/HTML when a user views crafted con...

CVE-2010-3928

Ruby Version Manager RVM before 1.2.1 writes file contents to a terminal without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via a crafted file, related to an "escape sequence injection vulnerability." NOTE: some of these details are...

Design/Logic Flaw

Ruby Version Manager RVM before 1.2.1 writes file contents to a terminal without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via a crafted file, related to an "escape sequence injection vulnerability." NOTE: some of these details are...

CVE-2010-3928

Ruby Version Manager (RVM) prior to 1.2.1 contains an escape sequence injection vulnerability. The issue arises because RVM writes file contents to a terminal without sanitizing non‑printable characters, enabling a crafted file to cause the terminal to process escape sequences. This could allow a...

CVE-2010-3928

Ruby Version Manager RVM before 1.2.1 writes file contents to a terminal without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via a crafted file, related to an "escape sequence injection vulnerability." NOTE: some of these details are...